Network data processing driver for a cognitive artificial intelligence system

1. A method, comprising:

receiving a first stream of data at a network data processing driver, and via a network, from at least one of a system log, a network device, a monitor system, and a simple network management protocol (SNMP) agent;

identifying a packet header from the first stream of data and extracting address information from the packet header;

separating the extracted address information into multiple address information components and converting the separated address information components into feature values, the feature values associated with the at least one of the system log, the network device, the monitor system, and the SNMP agent;

normalizing the feature values;

generating, via a neuro-linguistic model, patterns associated with the normalized feature values and related to network traffic attributes of the network;

generating statistics from the patterns;

generating a logical network topology based on the generated statistics;

generating a context-aware description of activity of the network based at least in part on a mapping of the normalized feature values in the logical network topology to corresponding network components; and

sending an alert signal representing an anomaly, via a cloud computing infrastructure, in response to detecting the anomaly in the activity of the network based on the patterns.

2. The method of claim 1 , wherein the address information includes at least one of:

a source Media Access Control (MAC) address;

a destination MAC address;

a network address; or

a data payload.

3. The method of claim 1 , wherein at least one of the normalized feature values includes a value between 0 and 1.

4. The method of claim 1 , further comprising:

receiving a second stream of data; and

updating the logical network topology based on the second stream of data.

5. The method of claim 4 , wherein updating the logical network topology includes:

extracting at least one feature value from a plurality of feature values of the second stream of data;

updating, via the neuro-linguistic model, a pattern associated with the extracted at least one feature value, to produce an updated pattern; and

updating the statistics based on the updated pattern.

6. The method of claim 1 , further comprising:

generating and tracking connectivity patterns representing network traffic attributes for the network.

7. The method of claim 1 , further comprising:

converting the alert signal representing the anomaly into a human-readable description of anomaly data associated with the anomaly.

8. The method of claim 1 , wherein the anomaly is associated with a network attack, the method further comprising determining whether to analyze the network attack.

9. The method of claim 1 , wherein the anomaly is associated with a network attack, and the network attack is one of: a distributed denial of service (DDoS) attack, an Internet Control Message Protocol (ICMP) flood attack, or network address spoofing.

10. The method of claim 1 , further comprising:

learning, via a machine learning engine, an association between at least one of the patterns and a network attack; and

analyzing the anomaly to determine that the anomaly is associated with the network attack.

11. The method of claim 10 , wherein the network attack is one of: a DDoS attack, an ICMP flood attack, or network address spoofing.

12. A non-transitory processor-readable medium storing instructions to cause a processor to:

receive a first stream of data at a network data processing driver and via a network from at least one of a system log, a network device, a monitor system, and a simple network management protocol (SNMP) agent;

identify a packet header from the first stream of data and extracting address information from the packet header;

separate the extracted address information into multiple address information components and converting the separated address information components to feature values, the feature values associated with the at least one of the system log, the network device, the monitor system, and the SNMP agent;

normalize the feature values;

generate, via a neuro-linguistic model, patterns associated with the normalized feature values and related to network traffic attributes of the network;

generate statistics from the patterns;

generate a logical network topology based on the generated statistics;

generate a context-aware description of activity of the network based at least in part on a mapping of the normalized feature values in the logical network topology to corresponding network components; and

send an alert signal representing an anomaly, via a cloud computing infrastructure, in response to detecting the anomaly in the activity of the network based on the patterns.

13. The non-transitory processor-readable medium of claim 12 , wherein the address information includes at least one of:

a source Media Access Control (MAC) address;

a destination MAC address;

a network address; or

a data payload.

14. The non-transitory processor-readable medium of claim 12 , wherein at least one of the normalized feature values includes a value between 0 and 1.

15. The non-transitory processor-readable medium of claim 12 , further storing instructions to cause the processor to:

receive a second stream of data; and

update the logical network topology based on the second stream of data.

16. The non-transitory processor-readable medium of claim 12 , further storing instructions to cause the processor to generate and track connectivity patterns representing network traffic attributes for the network.

17. The non-transitory processor-readable medium of claim 12 , further storing instructions to cause the processor to:

convert the alert signal representing the anomaly into a human-readable description of anomaly data associated with the anomaly.

18. The non-transitory processor-readable medium of claim 12 , wherein the anomaly is associated with a network attack, the non-transitory processor-readable medium further storing instructions to cause the processor to:

determine whether to analyze the network attack.

19. The non-transitory processor-readable medium of claim 12 , wherein the anomaly is associated with a network attack, and the network attack is one of: a distributed denial of service (DDoS) attack, an Internet Control Message Protocol (ICMP) flood attack, or network address spoofing.

20. The non-transitory processor-readable medium of claim 12 , further storing instructions to cause the processor to:

learn, via a machine learning engine, an association between at least one of the patterns and a network attack; and

analyze the anomaly to determine that the anomaly is associated with the network attack.